4 ms·

You can also turn on touch-to-use policy so that you have to touch the yubikey each time you want to use the key.

• hvidgaard 10y ago
  This is important. Physical action outside the computer should be required to access keys, otherwise a root access is enough to completely compromise the system.
  • StavrosK 10y ago
    Where by "completely compromise" you mean "an attacker can use your second factor while they have access to your computer and it's plugged in", which is pretty far from actual complete compromise (i.e. "an attacker can use your second factor at any time without needing to access anything of yours")
    • hvidgaard 10y ago
      In the context of it always being plugged in, and just handing out keys when the system asks for it, I call it completly compromised.
  • nickik 10y ago
    No. He still needs the PIN to actually use the Sign-Key. However that can be key-logged if your computer is compromised, so the extra 'touch' does add quite a bit of security. The U2F needs touch by definition anyway. GPG/PIV do not, this capability was added with the Yubikey 4.